pub struct WsConfig {
pub heartbeat_interval: Duration,
pub broadcast_capacity: usize,
pub max_connections: usize,
pub allowed_origins: Vec<String>,
}Expand description
Configuration for WebSocket connections and broadcast channels.
§Example
use ws_kit::config::WsConfig;
use std::time::Duration;
let cfg = WsConfig::builder()
.heartbeat_interval(Duration::from_secs(15))
.broadcast_capacity(2048)
.max_connections(5000)
.allow_origin("https://app.example.com")
.build();
assert_eq!(cfg.heartbeat_interval, Duration::from_secs(15));
assert_eq!(cfg.allowed_origins, vec!["https://app.example.com".to_string()]);Fields§
§heartbeat_interval: DurationInterval between heartbeat pings.
broadcast_capacity: usizeCapacity of each broadcast channel.
max_connections: usizeMaximum concurrent connections allowed (0 = unlimited).
allowed_origins: Vec<String>Origin allow-list for the WebSocket upgrade handshake (REQ-WSKIT-200).
WARNING — DEFAULT IS ALLOW-ALL: an empty list (the default)
accepts upgrades from ANY origin — cross-site WebSocket hijacking
(CSWSH) is possible, especially when authentication rides cookies.
This matches pre-0.3.0 behavior so existing users don’t break; it is
a documented residual risk (see THREAT-MODEL.md). Set at least the
origins your own frontend uses, e.g. https://app.example.com.
When non-empty, an upgrade whose Origin header is missing or not in
this list must be rejected with 403 before on_upgrade — use
ws_kit::origin_allowed_in_parts. Comparison is exact after
normalization (lowercase scheme/host, default ports omitted); no
wildcard or suffix matching in v1.